Azure Containers built-in role
AcrQuarantineWriter
AcrQuarantineWriter reads quarantined artifacts and changes their quarantine status. The definition combines quarantine read and write Actions with quarantined-artifact read and write DataActions; it does not grant ordinary repository artifact push or registry administration.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c8d4ff99-41c3-41a8-9f60-21dfdad59608
Control-plane actions (2)
Microsoft.ContainerRegistry/registries/quarantine/readMicrosoft.ContainerRegistry/registries/quarantine/write
Data-plane actions (2)
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/readMicrosoft.ContainerRegistry/registries/quarantinedArtifacts/write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry whose quarantine workflow the principal operates. A parent assignment is inherited by all registries below it and permits quarantine decisions across each inherited registry.
Common use cases (1)
- Allow a trusted scanning or release-gate identity to inspect quarantined artifacts and update their quarantine disposition.
Prerequisites (1)
- The registry must use a documented quarantine workflow with an approved scanner, release criterion, and incident-handling process.
Best practices (2)
- Use a dedicated workload identity and keep human review or audit access on AcrQuarantineReader.
- Log and review quarantine changes and require validated scan results before releasing an artifact.
Security considerations (2)
- Changing quarantine state can release untrusted content for downstream consumption or prevent approved content from being used.
- Its quarantined-artifact read and write DataActions expose potentially proprietary or malicious material and permit changing that material's quarantine status.
Assignment guidance
Assign AcrQuarantineWriter directly on one registry only to the trusted scanner or release-gate identity that changes quarantine state. Give responders who only inspect quarantined content AcrQuarantineReader instead.
Related roles (1)
- AcrQuarantineReader: Read-only quarantine inspection without permission to change quarantine state.
Common questions
When should I assign the AcrQuarantineWriter Azure role?
Assign AcrQuarantineWriter when you need to: Allow a trusted scanning or release-gate identity to inspect quarantined artifacts and update their quarantine disposition.. Practical scope: Assign on the individual registry whose quarantine workflow the principal operates. A parent assignment is inherited by all registries below it and permits quarantine decisions across each inherited registry.
What permissions does the AcrQuarantineWriter Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/quarantine/read; Microsoft.ContainerRegistry/registries/quarantine/write; Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read; and Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the AcrQuarantineWriter Azure role?
Key considerations when assigning AcrQuarantineWriter: Changing quarantine state can release untrusted content for downstream consumption or prevent approved content from being used.; and Its quarantined-artifact read and write DataActions expose potentially proprietary or malicious material and permit changing that material's quarantine status.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry Microsoft Entra permissions and role assignments overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.